# T05 Phase 1 Evidence — Empty Stack on railiance01 (2026-07-06)

Workplan: `CUST-WP-0054-T05`  
Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
`no_secret_material_recorded: true`

## Checklist

| Step | Action | Result | Evidence |
| --- | --- | --- | --- |
| 1.1 | Create `state-hub` namespace | **pass** | `kubectl get ns state-hub` |
| 1.2 | Deploy `state-hub-db` CNPG | **pass** | Cluster `databases/state-hub-db` healthy, 1 instance |
| 1.3 | Apply DB NetworkPolicies | **pass** | Applied from `deploy/railiance/platform/` |
| 1.4 | Create `state-hub-env` Secret | **pass** | `DATABASE_URL` → `state-hub-db-rw.databases.svc.cluster.local` |
| 1.5 | Helm image pin (Forgejo target) | **deferred** | Values updated; deploy uses gitea workaround (see § Image) |
| 1.6 | Alembic init Job | **pass** | `state-hub-alembic-init` Completed; head `f0a1b2c3d4e5` |
| 1.7 | Helm install + `/state/health` | **pass** | Pod Running; health `ok`, db `connected` |

**Phase 1 status: complete** (empty hub healthy; no production data). Phase 2 blocked on operator approval (Phase 0.6).

## Deployed resources (railiance01-k3s)

| Resource | Namespace | Status |
| --- | --- | --- |
| Secret `state-hub-db-credentials` | `databases` | present |
| CNPG Cluster `state-hub-db` | `databases` | healthy |
| Secret `state-hub-env` | `state-hub` | present |
| Helm release `state-hub` (rev 2) | `state-hub` | deployed |
| Job `state-hub-alembic-init` | `state-hub` | Completed |
| Deployment `state-hub` | `state-hub` | Running 1/1 |
| Service `state-hub` | `state-hub` | ClusterIP `10.43.68.154:8000` |

Kubeconfig: `KUBECONFIG=~/.kube/config-hosteurope` (workstation WSL).

## API verification (port-forward `18080:8000`)

```bash
curl -s http://127.0.0.1:18080/state/health
# {"status":"ok","db":"connected"}

curl -s http://127.0.0.1:18080/state/summary
# totals: topics=0, workstreams=0, tasks=0, decisions=0
```

Captured: 2026-07-06T16:24:19Z.

## Database verification (empty schema)

Alembic at head `f0a1b2c3d4e5`. Baseline gate tables — all **zero rows**:

| Table | Count |
| --- | ---: |
| `workplans` | 0 |
| `tasks` | 0 |
| `topics` | 0 |
| `progress_events` | 0 |
| `token_events` | 0 |
| `managed_repos` | 0 |
| `decisions` | 0 |

Queried via `kubectl exec` on `databases/state-hub-db-1` as `postgres`.

Post-Phase-2 restore must match coulombcore preflight counts exactly (see
`docs/state-hub-railiance01-cutover-preflight-2026-07-06.md`).

## Image workaround

| Image | Status | Notes |
| --- | --- | --- |
| `forgejo.coulomb.social/coulomb/state-hub:main-f9f0091` | **broken** | Empty venv (DinD `/tmp` + cache defect) |
| `forgejo.coulomb.social/coulomb/state-hub:main-d1a4fcf` | **fixed** | CI green @ `d1a4fcf`; `asyncpg` 0.31.0, 246-byte requirements |
| `gitea.coulomb.social/coulomb/state-hub:f2e042a` | **deployed** | Phase 1 Helm override; swap to Forgejo tag before Phase 2 |

**Root cause:** DinD legacy builder did not persist `/tmp` across RUN steps and
reused stale COPY layers; CI reported success at `f9f0091` with empty venv.
Fixed in `state-hub` @ `d1a4fcf` (single-RUN deps install under `/app`).

## Phase 2 prerequisites

- [ ] Operator approval for freeze/final restore (Phase 0.6)
- [x] Fix and republish Forgejo `state-hub` image (`main-d1a4fcf`)
- [ ] Helm upgrade railiance01 deploy to Forgejo image before Phase 2
- [ ] Fresh `pg_dump` from coulombcore per CUST-WP-0011-T07 playbook

## References

- `state-hub/deploy/railiance/apps/helm/state-hub-values.yaml` — Forgejo image pin
- `docs/state-hub-railiance01-cutover-plan.md` — Phase 2–5 sequence
- ClusterIP `10.43.68.154` — capture for Phase 3 tunnel rewire